The kernel bug in the xprtrdma subsystem prevents the reference counter for incoming RDMA RPCs from being decremented when work request allocation fails or the function exits early. As a result, the counter never reaches zero, causing rpcrdma_xprt_drain to block indefinitely and the kernel worker task to hang. The end effect is that the system loses responsiveness to RDMA RPC traffic and can exhibit blocked kworker threads, effectively a local denial of service.

This flaw is present in all Linux kernel releases containing the legacy xprtrdma code until the patch described by the cited kernel commits is applied. The example shown operates with kernel 6.19.0, but any kernel that uses the xprtrdma RPC transport and experiences high memory pressure could be vulnerable.

Although the flaw is not exploitable over the network, it can be triggered by a local process that causes rpcrdma_post_recvs to fail, which is likely under memory‑constrained conditions. Based on the description, it is inferred that the exploit path requires a local user or attacker with privileges to trigger a memory allocation failure and a kernel instance that has not been updated. The CVSS score of 7.0 indicates medium‑to‑high severity for a local denial of service. The EPSS score of <1% indicates an extremely low exploitation probability, and the vulnerability is not listed in CISA KEV.